fix: reject corrupt Oil installed.json instead of wiping it

[undivisible]

InstallState::new deserialized ~/.oil/installed.json with unwrap_or_default(), so truncated or poisoned JSON silently became an empty map and later save() would persist the wipe.

Now invalid JSON is an OilError::Install. Covered by test_install_state_rejects_corrupt_json.

cargo test -p oil 109 pass; --no-default-features 94 pass.

Review only: package/install state. Does not overlap #247 (redirect/keyname/APKINDEX cache).

---

Note

Low Risk
Narrow change to install-state loading; users with corrupt JSON will see an explicit error instead of a silent reset, which reduces accidental data loss.

Overview
InstallState::new no longer treats invalid ~/.oil/installed.json as an empty package map. Deserialization failures now return OilError::Install with a "corrupt install state" message (including the path and parse error), so a later save() cannot overwrite a broken file with a fresh empty state.

Adds test_install_state_rejects_corrupt_json to assert corrupt JSON fails load instead of succeeding with an empty map.

^{Reviewed by Cursor Bugbot for commit b4286b1. Configure here.}

[capy-ai]

Capy couldn't review this pull request because Max's workspace is out of credits, add credits or enable auto-reload to resume automatic reviews.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_27779fff-5881-47f2-9554-a5345c4bdfd4)

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request